@keycardai/eve 0.2.0 → 0.4.0

package/README.md

@@ -16,8 +16,9 @@ Three adapters, each one plugging into an eve primitive instead of wrapping it:
 pnpm add @keycardai/eve
 ```
 
-`eve` is a peer dependency, pinned to `>=0.54.3 <0.55.0`. This package was
-built and verified against eve `0.54.3`. eve is in public beta and ships
+`eve` is a peer dependency, pinned to `>=0.71.3 <0.72.0`: this package
+requires eve 0.71 and was built and verified against eve `0.71.3`. eve is in
+public beta and ships
 releases most days, and its connection and auth surfaces are still moving, so
 the range deliberately stops at the next minor rather than tracking `^`. Widen
 it only after re-running this package's tests against the newer eve.
@@ -27,7 +28,15 @@ range current: a consumer who runs a newer eve and installs this anyway —
 `--legacy-peer-deps` — silently loses the check, and the incompatibilities
 surface at build time instead. Two of them are what the 0.47 → 0.54 bump had to
 fix: an `auth` key list that `displayName` is not in, and a `requireAuth`
-options type with no `reason` field.
+options type with no `reason` field. The 0.54 → 0.71 bump moved non-interactive
+connection auth from `principalType` to `credentialOwner`.
+
+Upgrading an agent across eve 0.70 signs Slack users in once more: eve changed
+the Slack principal to `slack:<install team>:<user>`, and this package keys
+user-scoped tokens and grants by that principal, so the entries stored under the
+old principal are no longer found. Nothing else about the integration moves
+with the upgrade; the per-attempt callback
+(`/eve/v1/connections/:name/callback/:attemptId/:token`) is unchanged.
 
 eve itself declares `engines.node: ">=24"` and is ESM only. This package
 imports eve for types only (`import type { ... } from "eve/connections"`), so
@@ -106,6 +115,11 @@ export default defineMcpClientConnection({
   the connection app-scoped; a function receives the connection principal and
   makes it user-scoped.
 
+Each factory declares eve 0.71's `credentialOwner` (`"app"` or `"user"`) for
+the pattern it implements, which is how eve decides whether to cache the token
+once per connection or once per connection principal. Interactive definitions
+(below) keep eve's `principalType: "user"`.
+
 Nothing falls back to the agent's authority. A user-pattern connection with no
 user principal, a turn whose subject token was never retained, and an expired
 subject token all fail, each with its own reason: `principal_required`,
@@ -154,23 +168,23 @@ export default defineMcpClientConnection({
 ```
 
 **There is no `clientId`, and adding one usually breaks the flow.** eve mints a
-fresh callback URL for every attempt — `/eve/v1/connections/:name/callback/
-:attemptId/:token` — while [RFC 9700][rfc9700] requires the authorization server
-to match `redirect_uri` against the client's registered list by exact string
-comparison. A client registered ahead of time cannot name a URL that is
-generated later, so the request is rejected with something like
-`Unauthorized redirect URI`. Leaving `clientId` unset registers a client per
-attempt instead (RFC 7591), whose single redirect URI is the callback that
-attempt will actually return to. Each client is public and PKCE-bound, so
-nothing secret enters eve's durable resume state; if the server issues a
-confidential client anyway, the attempt is abandoned rather than journaling a
-secret.
+fresh callback URL for every attempt
+(`/eve/v1/connections/:name/callback/:attemptId/:token`) while
+[RFC 9700][rfc9700] requires the authorization server to match `redirect_uri`
+against the client's registered list by exact string comparison. A client
+registered ahead of time cannot name a URL that is generated later, so the
+request is rejected with something like `Unauthorized redirect URI`. Leaving
+`clientId` unset registers a client per attempt instead (RFC 7591), whose
+single redirect URI is the callback that attempt will return to. Each client is
+public and PKCE-bound, so nothing secret enters eve's durable resume state; if
+the server issues a confidential client anyway, the attempt is abandoned rather
+than journaling a secret.
 
 Set `clientId` only when that client's registered redirect URIs already cover
 eve's callback. Note that a Keycard application `identifier` is not a client id:
-zones identify clients by [Client ID Metadata Document][cimd] — an HTTPS URL
-with a path, serving the client's metadata — so a value like
-`urn:app:my-agent` fails with `Unsupported client identifier prefix: urn`.
+zones identify clients by [Client ID Metadata Document][cimd], an HTTPS URL
+with a path serving the client's metadata, so a value like `urn:app:my-agent`
+fails with `Unsupported client identifier prefix: urn`.
 
 Per-attempt clients accumulate in the zone. They hold no secret and their
 callback is single-use, but a server returning `registration_client_uri` and
@@ -182,17 +196,20 @@ callback is single-use, but a server returning `registration_client_uri` and
 The definition implements the same three-method form as eve's
 `defineInteractiveAuthorization`, over `@keycardai/oauth`'s v3 web-app flow:
 
-- `getToken` returns a token only when this package holds one for the
-  principal. Otherwise it throws `ConnectionAuthorizationRequiredError`, so eve
-  emits `authorization.required`, runs `startAuthorization` in a durable step,
-  and parks the turn on a framework-owned callback.
+- `getToken` looks up the principal's stored grants and returns the access
+  token of one whose resources cover this connection's `resource` and whose
+  scopes cover `requestScopes`. Within 60 seconds of expiry, a grant holding a
+  refresh token is refreshed first (see below). With no usable grant it throws
+  `ConnectionAuthorizationRequiredError`, so eve emits
+  `authorization.required`, runs `startAuthorization` in a durable step, and
+  parks the turn on a framework-owned callback.
 - `startAuthorization` registers this attempt's client (unless `clientId` is
   set), calls `beginAuthorization` for the connection's resource list against
   eve's minted callback URL, and returns the challenge URL plus the `state`,
   PKCE verifier and client id as JSON resume state.
 - `completeAuthorization` calls `completeAuthorization` with eve's callback
   params and the journaled resume state, redeeming as the client that attempt's
-  authorization request ran as, and hands eve the token.
+  authorization request ran as, and stores the resulting grant.
 
 **Resume without authorization cannot yield a credential.** `getToken` is the
 only path that returns a token, and it reads a store only
@@ -204,6 +221,72 @@ an authorization has settled ends the tool call. User denial is reported as
 `ConnectionAuthorizationFailedError` with `reason: "access_denied"` and
 `retryable: false`, so eve stops re-prompting.
 
+### Grants: what is stored, and for how long
+
+`completeAuthorization` stores a grant, not a bare token: the access token and
+its expiry, the refresh token the zone returned, the client id the grant was
+issued to, and the resources and scopes granted. Grants are keyed by the
+principal, never by `connectionName`, which is display and error text only;
+two `Keycard.interactive()` definitions in one process with the same
+`connectionName` fail at definition time with
+`AuthProviderConfigurationError`. Because a grant is matched on what it covers,
+a connection listing the agent's other resources in `additionalResources`
+yields one sign-in that serves every connection whose resource is in the list.
+
+When a grant is within 60 seconds of expiry and holds a refresh token,
+`getToken` posts `grant_type=refresh_token` to the zone as the grant's own
+client (public, no secret; a per-attempt client registers with
+`refresh_token` among its grant types), stores the rotated access and refresh
+token pair, and returns the new access token without parking. A refresh the
+zone refuses with `invalid_grant` deletes the grant and throws `Required`, so
+the turn parks for a fresh sign-in. A transport or 5xx failure keeps the grant
+and fails the tool call with `retryable: true`. A grant without a refresh token
+parks at expiry, as before.
+
+`evict` removes every grant of the principal that covers this connection's
+resource, leaving grants for other resources in place.
+
+### Plugging a durable grant store
+
+The default store is process-local, so a restarted agent parks once more for
+each user. To keep grants across processes, pass `tokens` an object of this
+shape:
+
+```ts
+import type { AuthorizedGrant, GrantStore } from "@keycardai/eve";
+
+export function redisGrantStore(redis: {
+  hgetall(key: string): Promise<Record<string, string>>;
+  hset(key: string, field: string, value: string): Promise<unknown>;
+  hdel(key: string, field: string): Promise<unknown>;
+}): GrantStore {
+  const key = (principal: string) => `keycard:grants:${principal}`;
+  return {
+    async list(principal) {
+      const rows = await redis.hgetall(key(principal));
+      return Object.values(rows).map((row) => JSON.parse(row) as AuthorizedGrant);
+    },
+    async put(principal, grant) {
+      await redis.hset(key(principal), grant.id, JSON.stringify(grant));
+    },
+    async remove(principal, grantId) {
+      await redis.hdel(key(principal), grantId);
+    },
+  };
+}
+```
+
+Every method is async, and `put` with an `id` already held replaces that grant
+(a refresh rewrites the rotated pair under the same `id`). The same three
+methods map onto Upstash Redis's `hgetall`, `hset` and `hdel`, or any other
+key-value backend.
+
+Choosing a durable store puts refresh tokens at rest in that backend. Each one
+is a long-lived credential for the user's resources, so the backend's access
+control and encryption are yours to provide. This package never writes a grant
+into eve's session attributes for that reason: a refresh token must not enter
+eve's durable state.
+
 ## Parity with `@keycardai/langchain`
 
 The two packages implement the same Keycard access model against different
@@ -247,8 +330,8 @@ const auth = Keycard.onBehalfOf({
 `fakeZoneClient()` records every exchange, impersonation, and client
 credentials call, and can fail one resource or every request. `keycardAuth()`
 takes a `verify` seam in place of the JWKS-backed verifier, and
-`Keycard.interactive()` takes a `flow` seam in place of the web-flow calls —
-`begin`, `complete`, and the `register` used for per-attempt clients. A flow
+`Keycard.interactive()` takes a `flow` seam in place of the web-flow calls:
+`begin`, `complete`, `register` for per-attempt clients, and `refresh`. A flow
 without `register` is rejected at construction unless a `clientId` is also
 given, so a test cannot accidentally exercise a combination that cannot work in
 production. An injected `client` or `flow` supersedes `zoneUrl`, so a test needs

package/dist/esm/connections.d.ts

@@ -1,25 +1,28 @@
-import type { ConnectionPrincipal, NonInteractiveAuthorizationDefinition } from "eve/connections";
+import type { ConnectionPrincipal, CredentialOwner, NonInteractiveAuthorizationDefinition } from "eve/connections";
 import { type KeycardConnectionOptions } from "./config.js";
 /**
- * NONE OF THESE DEFINITIONS CARRY A `displayName`, and adding one back breaks
- * every connection that uses them.
- *
- * eve validates an authored connection's `auth` against a closed key list —
- * `completeAuthorization`, `evict`, `getToken`, `principalType`,
- * `startAuthorization`, `vercelConnect` — and `displayName` is not in it, so a
- * definition carrying one fails the BUILD with
- * `The "auth" field Unknown key "displayName"`. That is an inconsistency inside
- * eve rather than a rule: its `normalizeAuthorizationSpec` accepts and forwards
- * the field, and only the authored-module key check disagrees. Until the two
- * agree, a package whose whole purpose is to be dropped into `auth:` has to
- * keep off the key.
- *
- * Nothing is lost. The only consumer of a definition-level `displayName` is
- * eve's `stampChallengeDisplayName`, which resolves
- * `definition.displayName ?? challenge.displayName` — so a name supplied on the
- * challenge still reaches the sign-in prompt (see {@link interactive}), and a
- * non-interactive definition has no challenge to name in the first place. Tools
- * name a provider through `ToolAuthOptions.displayName` at the call site.
+ * A non-interactive connection auth definition as eve 0.71 accepts it:
+ * `credentialOwner` declares whether the credential belongs to the agent
+ * (`"app"`, one token per connection across sessions) or to the end user
+ * (`"user"`, one token per connection principal). eve deprecated
+ * `principalType` on non-interactive auth in favor of it; interactive
+ * definitions still use `principalType: "user"`.
+ */
+export type KeycardConnectionAuth = Omit<NonInteractiveAuthorizationDefinition, "principalType"> & {
+    readonly credentialOwner: CredentialOwner;
+};
+/**
+ * None of these definitions carry a `displayName`. eve validates an authored
+ * connection's `auth` against a closed key list (`completeAuthorization`,
+ * `credentialOwner`, `evict`, `getToken`, `principalType`,
+ * `startAuthorization`, `vercelConnect`),
+ * and a definition carrying any other key fails the build with
+ * `The "auth" field Unknown key "displayName"`. The only consumer of the field
+ * is eve's `stampChallengeDisplayName`, which resolves
+ * `definition.displayName ?? challenge.displayName`, so an interactive
+ * definition names itself on the challenge instead (see {@link interactive}),
+ * a non-interactive one has no challenge to name, and tools name a provider
+ * through `ToolAuthOptions.displayName` at the call site.
  */
 /** Options for {@link impersonate}. */
 export interface KeycardImpersonateOptions extends KeycardConnectionOptions {
@@ -36,7 +39,7 @@ export interface KeycardImpersonateOptions extends KeycardConnectionOptions {
  * user, so this works on schedules and subagent turns. No exchange and no
  * impersonation, so nothing about the caller reaches the zone.
  */
-export declare function asSelf(options: KeycardConnectionOptions): NonInteractiveAuthorizationDefinition;
+export declare function asSelf(options: KeycardConnectionOptions): KeycardConnectionAuth;
 /**
  * Connection auth that exchanges the caller's token for a resource token.
  *
@@ -52,7 +55,7 @@ export declare function asSelf(options: KeycardConnectionOptions): NonInteractiv
  * the sign-in signal, decided by a decode-only expiry check so an already
  * dead token never costs an exchange round trip.
  */
-export declare function onBehalfOf(options: KeycardConnectionOptions): NonInteractiveAuthorizationDefinition;
+export declare function onBehalfOf(options: KeycardConnectionOptions): KeycardConnectionAuth;
 /**
  * Connection auth that acts for a named user the agent holds no token for.
  *
@@ -65,5 +68,5 @@ export declare function onBehalfOf(options: KeycardConnectionOptions): NonIntera
  * `principal_required` rejection; a fixed identifier needs no caller, so the
  * connection is app-scoped and runs on schedules.
  */
-export declare function impersonate(options: KeycardImpersonateOptions): NonInteractiveAuthorizationDefinition;
+export declare function impersonate(options: KeycardImpersonateOptions): KeycardConnectionAuth;
 //# sourceMappingURL=connections.d.ts.map

package/dist/esm/connections.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connections.d.ts","sourceRoot":"","sources":["../../src/connections.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACV,mBAAmB,EACnB,qCAAqC,EAEtC,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAsC,KAAK,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAKhG;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,uCAAuC;AACvC,MAAM,WAAW,yBAA0B,SAAQ,wBAAwB;IACzE;;;OAGG;IACH,cAAc,EAAE,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,mBAAmB,KAAK,MAAM,CAAC,CAAC;CACvE;AAED;;;;;;GAMG;AACH,wBAAgB,MAAM,CACpB,OAAO,EAAE,wBAAwB,GAChC,qCAAqC,CAkBvC;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAAE,wBAAwB,GAChC,qCAAqC,CAkDvC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,yBAAyB,GACjC,qCAAqC,CAsCvC"}
+{"version":3,"file":"connections.d.ts","sourceRoot":"","sources":["../../src/connections.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACV,mBAAmB,EACnB,eAAe,EACf,qCAAqC,EAEtC,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAsC,KAAK,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAKhG;;;;;;;GAOG;AACH,MAAM,MAAM,qBAAqB,GAAG,IAAI,CACtC,qCAAqC,EACrC,eAAe,CAChB,GAAG;IACF,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;CAC3C,CAAC;AAEF;;;;;;;;;;;;GAYG;AAEH,uCAAuC;AACvC,MAAM,WAAW,yBAA0B,SAAQ,wBAAwB;IACzE;;;OAGG;IACH,cAAc,EAAE,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,mBAAmB,KAAK,MAAM,CAAC,CAAC;CACvE;AAED;;;;;;GAMG;AACH,wBAAgB,MAAM,CACpB,OAAO,EAAE,wBAAwB,GAChC,qBAAqB,CAkBvB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAAE,wBAAwB,GAChC,qBAAqB,CAkDvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,yBAAyB,GACjC,qBAAqB,CAsCvB"}

package/dist/esm/connections.js

@@ -13,7 +13,7 @@ import { principalKey, readSubjectToken } from "./subjectTokens.js";
 export function asSelf(options) {
     const config = resolveConnectionConfig(options, "asSelf");
     return {
-        principalType: "app",
+        credentialOwner: "app",
         async getToken() {
             const request = {
                 resource: config.resource,
@@ -42,7 +42,7 @@ export function asSelf(options) {
 export function onBehalfOf(options) {
     const config = resolveConnectionConfig(options, "onBehalfOf");
     return {
-        principalType: "user",
+        credentialOwner: "user",
         async getToken({ principal }) {
             requireUser(principal, config.connectionName);
             const subjectToken = readSubjectToken(principal, config.subjectTokens);
@@ -100,7 +100,7 @@ export function impersonate(options) {
         throw new AuthProviderConfigurationError("impersonate requires a non-empty user identifier");
     }
     return {
-        principalType: typeof identifier === "function" ? "user" : "app",
+        credentialOwner: typeof identifier === "function" ? "user" : "app",
         async getToken({ principal }) {
             let userIdentifier;
             if (typeof identifier === "function") {

package/dist/esm/connections.js.map

@@ -1 +1 @@
-{"version":3,"file":"connections.js","sourceRoot":"","sources":["../../src/connections.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,SAAS,GAIV,MAAM,kBAAkB,CAAC;AAO1B,OAAO,EAAE,SAAS,EAAE,uBAAuB,EAAiC,MAAM,aAAa,CAAC;AAChG,OAAO,EAAE,wBAAwB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAiCpE;;;;;;GAMG;AACH,MAAM,UAAU,MAAM,CACpB,OAAiC;IAEjC,MAAM,MAAM,GAAG,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAE1D,OAAO;QACL,aAAa,EAAE,KAAK;QACpB,KAAK,CAAC,QAAQ;YACZ,MAAM,OAAO,GAA6B;gBACxC,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChD,GAAG,CAAC,MAAM,MAAM,CAAC,gBAAgB,EAAE,CAAC;aACrC,CAAC;YACF,OAAO,WAAW,CAChB,MAAM,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,CACxC,MAAM,CAAC,UAAU,EAAE,CAAC,sBAAsB,CAAC,OAAO,CAAC,CACpD,CACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,UAAU,CACxB,OAAiC;IAEjC,MAAM,MAAM,GAAG,uBAAuB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAE9D,OAAO;QACL,aAAa,EAAE,MAAM;QACrB,KAAK,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE;YAC1B,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;YAE9C,MAAM,YAAY,GAAG,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;YACvE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,IAAI,wBAAwB,CAAC,MAAM,CAAC,cAAc,EAAE;oBACxD,OAAO,EACL,sEAAsE;wBACtE,wEAAwE;wBACxE,2EAA2E;wBAC3E,cAAc;oBAChB,MAAM,EAAE,aAAa,CAAC,yBAAyB;oBAC/C,SAAS,EAAE,KAAK;iBACjB,CAAC,CAAC;YACL,CAAC;YACD,IAAI,mBAAmB,CAAC,YAAY,CAAC,EAAE,CAAC;gBACtC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;gBACrD,MAAM,IAAI,wBAAwB,CAAC,MAAM,CAAC,cAAc,EAAE;oBACxD,OAAO,EACL,iFAAiF;oBACnF,MAAM,EAAE,aAAa,CAAC,qBAAqB;oBAC3C,SAAS,EAAE,KAAK;iBACjB,CAAC,CAAC;YACL,CAAC;YAED,IAAI,OAA6B,CAAC;YAClC,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;gBACtB,OAAO,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,2BAA2B,CAC3D,YAAY,EACZ,MAAM,CAAC,QAAQ,CAChB,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG;oBACR,YAAY;oBACZ,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,gBAAgB,EAAE,SAAS,CAAC,YAAY;iBACzC,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,CAAC,KAAK;gBAAE,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;YAEhE,OAAO,WAAW,CAChB,MAAM,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CACvF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,WAAW,CACzB,OAAkC;IAElC,MAAM,MAAM,GAAG,uBAAuB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC;IAC1C,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;QACzD,MAAM,IAAI,8BAA8B,CACtC,kDAAkD,CACnD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,aAAa,EAAE,OAAO,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;QAChE,KAAK,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE;YAC1B,IAAI,cAAsB,CAAC;YAC3B,IAAI,OAAO,UAAU,KAAK,UAAU,EAAE,CAAC;gBACrC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;gBAC9C,cAAc,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;YACzC,CAAC;iBAAM,CAAC;gBACN,cAAc,GAAG,UAAU,CAAC;YAC9B,CAAC;YACD,IAAI,CAAC,cAAc,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC9C,MAAM,IAAI,wBAAwB,CAAC,MAAM,CAAC,cAAc,EAAE;oBACxD,OAAO,EAAE,8DAA8D;oBACvE,MAAM,EAAE,aAAa,CAAC,kBAAkB;oBACxC,SAAS,EAAE,KAAK;iBACjB,CAAC,CAAC;YACL,CAAC;YAED,OAAO,WAAW,CAChB,MAAM,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,CACxC,MAAM,CAAC,UAAU,EAAE,CAAC,WAAW,CAAC;gBAC9B,cAAc;gBACd,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjD,CAAC,CACH,CACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAClB,SAA8B,EAC9B,cAAsB;IAEtB,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO;IACtC,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;QACjD,OAAO,EACL,6EAA6E;YAC7E,iBAAiB;QACnB,MAAM,EAAE,aAAa,CAAC,kBAAkB;QACxC,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,OAAO,CACpB,cAAsB,EACtB,OAAqC;IAErC,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,EAAE,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;YACjD,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B;YAC5E,MAAM,EAAE,aAAa,CAAC,kBAAkB;YACxC,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,QAAuB;IAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC7C,OAAO;QACL,KAAK,EAAE,QAAQ,CAAC,WAAW;QAC3B,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"connections.js","sourceRoot":"","sources":["../../src/connections.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,SAAS,GAIV,MAAM,kBAAkB,CAAC;AAQ1B,OAAO,EAAE,SAAS,EAAE,uBAAuB,EAAiC,MAAM,aAAa,CAAC;AAChG,OAAO,EAAE,wBAAwB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAwCpE;;;;;;GAMG;AACH,MAAM,UAAU,MAAM,CACpB,OAAiC;IAEjC,MAAM,MAAM,GAAG,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAE1D,OAAO;QACL,eAAe,EAAE,KAAK;QACtB,KAAK,CAAC,QAAQ;YACZ,MAAM,OAAO,GAA6B;gBACxC,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChD,GAAG,CAAC,MAAM,MAAM,CAAC,gBAAgB,EAAE,CAAC;aACrC,CAAC;YACF,OAAO,WAAW,CAChB,MAAM,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,CACxC,MAAM,CAAC,UAAU,EAAE,CAAC,sBAAsB,CAAC,OAAO,CAAC,CACpD,CACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,UAAU,CACxB,OAAiC;IAEjC,MAAM,MAAM,GAAG,uBAAuB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAE9D,OAAO;QACL,eAAe,EAAE,MAAM;QACvB,KAAK,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE;YAC1B,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;YAE9C,MAAM,YAAY,GAAG,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;YACvE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,IAAI,wBAAwB,CAAC,MAAM,CAAC,cAAc,EAAE;oBACxD,OAAO,EACL,sEAAsE;wBACtE,wEAAwE;wBACxE,2EAA2E;wBAC3E,cAAc;oBAChB,MAAM,EAAE,aAAa,CAAC,yBAAyB;oBAC/C,SAAS,EAAE,KAAK;iBACjB,CAAC,CAAC;YACL,CAAC;YACD,IAAI,mBAAmB,CAAC,YAAY,CAAC,EAAE,CAAC;gBACtC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;gBACrD,MAAM,IAAI,wBAAwB,CAAC,MAAM,CAAC,cAAc,EAAE;oBACxD,OAAO,EACL,iFAAiF;oBACnF,MAAM,EAAE,aAAa,CAAC,qBAAqB;oBAC3C,SAAS,EAAE,KAAK;iBACjB,CAAC,CAAC;YACL,CAAC;YAED,IAAI,OAA6B,CAAC;YAClC,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;gBACtB,OAAO,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,2BAA2B,CAC3D,YAAY,EACZ,MAAM,CAAC,QAAQ,CAChB,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG;oBACR,YAAY;oBACZ,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,gBAAgB,EAAE,SAAS,CAAC,YAAY;iBACzC,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,CAAC,KAAK;gBAAE,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;YAEhE,OAAO,WAAW,CAChB,MAAM,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CACvF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,WAAW,CACzB,OAAkC;IAElC,MAAM,MAAM,GAAG,uBAAuB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC;IAC1C,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;QACzD,MAAM,IAAI,8BAA8B,CACtC,kDAAkD,CACnD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,eAAe,EAAE,OAAO,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;QAClE,KAAK,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE;YAC1B,IAAI,cAAsB,CAAC;YAC3B,IAAI,OAAO,UAAU,KAAK,UAAU,EAAE,CAAC;gBACrC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;gBAC9C,cAAc,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;YACzC,CAAC;iBAAM,CAAC;gBACN,cAAc,GAAG,UAAU,CAAC;YAC9B,CAAC;YACD,IAAI,CAAC,cAAc,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC9C,MAAM,IAAI,wBAAwB,CAAC,MAAM,CAAC,cAAc,EAAE;oBACxD,OAAO,EAAE,8DAA8D;oBACvE,MAAM,EAAE,aAAa,CAAC,kBAAkB;oBACxC,SAAS,EAAE,KAAK;iBACjB,CAAC,CAAC;YACL,CAAC;YAED,OAAO,WAAW,CAChB,MAAM,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,CACxC,MAAM,CAAC,UAAU,EAAE,CAAC,WAAW,CAAC;gBAC9B,cAAc;gBACd,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjD,CAAC,CACH,CACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAClB,SAA8B,EAC9B,cAAsB;IAEtB,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO;IACtC,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;QACjD,OAAO,EACL,6EAA6E;YAC7E,iBAAiB;QACnB,MAAM,EAAE,aAAa,CAAC,kBAAkB;QACxC,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,OAAO,CACpB,cAAsB,EACtB,OAAqC;IAErC,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,EAAE,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;YACjD,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B;YAC5E,MAAM,EAAE,aAAa,CAAC,kBAAkB;YACxC,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,QAAuB;IAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC7C,OAAO;QACL,KAAK,EAAE,QAAQ,CAAC,WAAW;QAC3B,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAC;AACJ,CAAC"}

package/dist/esm/index.d.ts

@@ -17,9 +17,9 @@
 export { keycardAuth } from "./auth.js";
 export type { KeycardAuthOptions, SubjectTokenRetention } from "./auth.js";
 export { asSelf, impersonate, onBehalfOf } from "./connections.js";
-export type { KeycardImpersonateOptions } from "./connections.js";
+export type { KeycardConnectionAuth, KeycardImpersonateOptions } from "./connections.js";
 export { interactive, memoryAuthorizedTokenStore } from "./interactive.js";
-export type { AuthorizedToken, AuthorizedTokenStore, KeycardInteractiveOptions, KeycardResumeState, RegisterAttemptClientOptions, RegisteredClient, WebAppFlow, } from "./interactive.js";
+export type { AuthorizedGrant, GrantStore, KeycardInteractiveOptions, KeycardResumeState, RegisterAttemptClientOptions, RegisteredClient, WebAppFlow, } from "./interactive.js";
 export type { KeycardConnectionOptions } from "./config.js";
 export { AuthorizationFailedError, AuthorizationRequiredError, FailureReason, RouteRejectedError, } from "./errors.js";
 export { decodeClaims, subjectTokenExpired } from "./expiry.js";

package/dist/esm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,YAAY,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAE3E,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnE,YAAY,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAElE,OAAO,EAAE,WAAW,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAC3E,YAAY,EACV,eAAe,EACf,oBAAoB,EACpB,yBAAyB,EACzB,kBAAkB,EAClB,4BAA4B,EAC5B,gBAAgB,EAChB,UAAU,GACX,MAAM,kBAAkB,CAAC;AAE1B,YAAY,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAE5D,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,aAAa,EACb,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEhE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C;;;GAGG;AACH,eAAO,MAAM,OAAO;;;;;EAKlB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,YAAY,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAE3E,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnE,YAAY,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAEzF,OAAO,EAAE,WAAW,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAC3E,YAAY,EACV,eAAe,EACf,UAAU,EACV,yBAAyB,EACzB,kBAAkB,EAClB,4BAA4B,EAC5B,gBAAgB,EAChB,UAAU,GACX,MAAM,kBAAkB,CAAC;AAE1B,YAAY,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAE5D,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,aAAa,EACb,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEhE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C;;;GAGG;AACH,eAAO,MAAM,OAAO;;;;;EAKlB,CAAC"}

package/dist/esm/interactive.d.ts

@@ -1,16 +1,13 @@
-import { type AuthorizationRedirect, type BeginAuthorizationOptions, type CompleteAuthorizationOptions, type TokenResponse } from "@keycardai/oauth";
+import { type AuthorizationRedirect, type BeginAuthorizationOptions, type CompleteAuthorizationOptions, type RefreshAuthorizationOptions, type TokenResponse } from "@keycardai/oauth";
 import type { InteractiveAuthorizationDefinition, JsonValue } from "eve/connections";
 /**
  * The state journaled between eve's begin and callback steps.
  *
  * Every field is JSON, so the value satisfies eve's `JsonValue` bound and
- * survives the durable step boundary the park crosses.
- *
- * `clientId` is journaled because it is not necessarily the same value across
- * attempts: under per-attempt registration each authorization runs as its own
- * client, and the code can only be redeemed by the client the authorization
- * request was made with. Nothing secret is journaled — registered clients are
- * public and PKCE-bound; see {@link interactive}.
+ * survives the durable step boundary the park crosses. `clientId` is journaled
+ * because each attempt may run as its own registered client, and only that
+ * client can redeem the code. Nothing secret is journaled: registered clients
+ * are public and PKCE-bound (see {@link interactive}).
  */
 export interface KeycardResumeState {
     readonly state: string;
@@ -20,25 +17,38 @@ export interface KeycardResumeState {
     readonly clientId: string;
     readonly [key: string]: JsonValue;
 }
-/** A token this package minted for one principal, plus its advisory expiry. */
-export interface AuthorizedToken {
-    readonly token: string;
+/**
+ * A completed authorization for one principal.
+ *
+ * `resources` and `scopes` are what the zone granted, and decide which
+ * connections the grant serves. `clientId` is the client the grant was issued
+ * to, and the client a refresh runs as. `id` is stable across refreshes, so a
+ * store can replace the rotated pair in place.
+ */
+export interface AuthorizedGrant {
+    readonly id: string;
+    readonly accessToken: string;
     readonly expiresAt?: number;
-    readonly providerSubject?: string;
+    readonly refreshToken?: string;
+    readonly clientId: string;
+    readonly resources: readonly string[];
+    readonly scopes: readonly string[];
 }
 /**
- * Where completed authorizations live between turns.
+ * Where completed grants live between turns, keyed by principal.
  *
- * eve caches a resolved bearer for the duration of a step, and reruns
- * `getToken` after that. This store is what makes a second step reuse the
- * grant a user already completed instead of parking the turn again. The
- * default is process-local, so a fresh process re-parks rather than
- * resurrecting a credential from durable state.
+ * eve caches a resolved bearer for the duration of a step and reruns
+ * `getToken` after that; this store is what makes a later step reuse the grant
+ * a user already completed instead of parking again. `put` with an `id` the
+ * store already holds replaces that grant. The default is process-local, so a
+ * fresh process re-parks. A durable implementation (Redis, Upstash Redis) keeps the
+ * grant, refresh token included, at rest in that backend; eve's session
+ * attributes are never used, so no credential enters eve's durable state.
  */
-export interface AuthorizedTokenStore {
-    get(key: string): AuthorizedToken | undefined;
-    set(key: string, token: AuthorizedToken): void;
-    delete(key: string): void;
+export interface GrantStore {
+    list(principal: string): Promise<readonly AuthorizedGrant[]>;
+    put(principal: string, grant: AuthorizedGrant): Promise<void>;
+    remove(principal: string, grantId: string): Promise<void>;
 }
 /** What one authorization attempt needs its own OAuth client for. */
 export interface RegisterAttemptClientOptions {
@@ -67,6 +77,11 @@ export interface WebAppFlow {
      * `clientId` is configured, and unused when one is.
      */
     register?(options: RegisterAttemptClientOptions): Promise<RegisteredClient>;
+    /**
+     * Refreshes a grant at the token endpoint. When absent, a grant near expiry
+     * parks for a fresh sign-in instead.
+     */
+    refresh?(options: RefreshAuthorizationOptions): Promise<TokenResponse>;
 }
 export interface KeycardInteractiveOptions {
     /** The resource URL the authorization is scoped to. */
@@ -76,18 +91,16 @@ export interface KeycardInteractiveOptions {
     /**
      * OAuth client the browser flow runs as.
      *
-     * OMIT THIS unless the client's registered redirect URIs already cover eve's
-     * callback. eve mints a fresh callback URL per attempt — the route is
-     * `/eve/v1/connections/:name/callback/:attemptId/:token` — while RFC 9700
+     * Leave this unset unless the client's registered redirect URIs already
+     * cover eve's callback. eve mints a fresh callback URL per attempt
+     * (`/eve/v1/connections/:name/callback/:attemptId/:token`) while RFC 9700
      * requires the authorization server to match `redirect_uri` by exact string
-     * comparison. A statically registered client therefore cannot name the URL
-     * the next attempt will use, and the request is rejected. Leaving this unset
-     * registers the client per attempt instead, which is the only arrangement
-     * that satisfies both.
+     * comparison, so a statically registered client cannot name the URL the next
+     * attempt will use. Unset, the client is registered per attempt instead.
      *
-     * A Keycard application `identifier` is NOT a client id. Zones identify
-     * clients by Client ID Metadata Document — an HTTPS URL with a path that
-     * serves the client's metadata — so a value like `urn:app:my-agent` fails
+     * A Keycard application `identifier` is not a client id. Zones identify
+     * clients by Client ID Metadata Document, an HTTPS URL with a path that
+     * serves the client's metadata, so a value like `urn:app:my-agent` fails
      * with `Unsupported client identifier prefix: urn`.
      */
     clientId?: string;
@@ -99,65 +112,77 @@ export interface KeycardInteractiveOptions {
      */
     clientName?: string;
     /**
-     * Initial access token (RFC 7591 §3.1) for a zone whose registration
+     * Initial access token (RFC 7591 section 3.1) for a zone whose registration
      * endpoint is authenticated. Unset for an open registration endpoint.
      */
     initialAccessToken?: string;
-    /** Scopes requested in the authorization request. */
+    /**
+     * Scopes requested in the authorization request, and the scopes a stored
+     * grant must cover to serve this connection.
+     */
     requestScopes?: string | readonly string[];
-    /** Extra resources authorized alongside `resource`. */
+    /**
+     * Extra resources authorized alongside `resource`. The resulting grant
+     * serves every connection whose resource it covers.
+     */
     additionalResources?: readonly string[];
-    /** Name used in error messages and eve's authorization events. */
+    /**
+     * Name used in the challenge, error messages and eve's authorization
+     * events. Display text only, never a store key; two definitions in one
+     * process may not share it.
+     */
     connectionName?: string;
-    /** Store for completed authorizations. Defaults to a process-local store. */
-    tokens?: AuthorizedTokenStore;
+    /** Store for completed grants. Defaults to a process-local store. */
+    tokens?: GrantStore;
     /** Web-flow seam. Replaces the zone calls, so tests take no network. */
     flow?: WebAppFlow;
 }
+/** Forgets every defined connection name. For tests that define many. */
+export declare function resetInteractiveDefinitions(): void;
 /**
  * Interactive connection auth backed by the zone's web authorization flow.
  *
  * The three callbacks eve drives:
  *
- * - `getToken` returns a token only when this package holds one for the
- *   principal. Otherwise it throws `ConnectionAuthorizationRequiredError`, and
- *   eve emits `authorization.required`, runs `startAuthorization` in a durable
- *   step, and parks the turn on its own callback webhook.
- * - `startAuthorization` begins the authorization-code flow with PKCE for the
- *   connection's resources, against eve's minted callback URL, and returns the
- *   challenge URL plus the `state` and verifier as resume state.
- * - `completeAuthorization` redeems the callback against the journaled resume
- *   state and hands eve the token.
+ * - `getToken` returns a token when the store holds a grant for the principal
+ *   whose resources cover this connection's resource and whose scopes cover
+ *   `requestScopes`, refreshing it first when it is near expiry and holds a
+ *   refresh token. Otherwise it throws `ConnectionAuthorizationRequiredError`,
+ *   and eve emits `authorization.required`, runs `startAuthorization` in a
+ *   durable step, and parks the turn on its own callback webhook.
+ * - `startAuthorization` registers the attempt's client, begins the
+ *   authorization-code flow with PKCE for the connection's resources against
+ *   eve's minted callback URL, and returns the challenge URL plus the state,
+ *   verifier, resources, callback URL and client id as resume state.
+ * - `completeAuthorization` redeems the callback as the journaled client and
+ *   stores the resulting grant.
  *
- * Resuming without a completed authorization cannot yield a credential.
- * `getToken` is the only path that returns a token and it reads the store,
- * which only `completeAuthorization` writes; a denied, mismatched, or failed
- * callback writes nothing. So a resumed turn either finds a real grant or
- * throws `Required` again and parks. eve's own settlement makes that terminal
- * rather than an endless loop: it settles each parked authorization once, and
- * a `Required` thrown after a completed authorization ends the tool call.
+ * Resuming without a completed authorization cannot yield a credential: only
+ * `completeAuthorization` writes the store, and a denied, mismatched, or failed
+ * callback writes nothing, so a resumed turn either finds a real grant or parks
+ * again. eve settles each parked authorization once, so that is terminal rather
+ * than a loop.
  *
- * THE CLIENT IS REGISTERED PER ATTEMPT unless `clientId` says otherwise, and
- * that is not an optimization — it is what makes the flow work at all. eve
- * mints a fresh callback URL for every attempt, carrying the attempt id and a
- * run token in its path, while RFC 9700 requires the authorization server to
- * match `redirect_uri` against the client's registered list by exact string
- * comparison. No fixed registration can name a URL that is generated later, so
- * a static client and a dynamic callback cannot both hold. Registering the
- * client alongside the callback it belongs to resolves it: each attempt gets a
- * public, PKCE-bound client whose one redirect URI is the one URL that attempt
- * will return to.
+ * The client is registered per attempt unless `clientId` is set. eve mints a
+ * fresh callback URL for every attempt, while RFC 9700 requires the
+ * authorization server to match `redirect_uri` against the client's registered
+ * list by exact string comparison, so no fixed registration can name a URL that
+ * is generated later. Each attempt therefore gets a public, PKCE-bound client
+ * whose one redirect URI is the callback that attempt returns to. Those client
+ * records accumulate in the zone; a server that returns
+ * `registration_client_uri` and `registration_access_token` allows RFC 7592
+ * deletion once a grant settles.
  *
- * Each attempt therefore leaves a client record in the zone. They are public,
- * hold no secret, and are bound to a callback URL that is single-use, but they
- * do accumulate; a server that returns `registration_client_uri` and
- * `registration_access_token` allows RFC 7592 deletion once a grant settles.
+ * Grants are keyed by principal, never by `connectionName`, so two connections
+ * never share a token through a shared name and `evict` on one cannot clear the
+ * other's grant. A grant obtained with `additionalResources` serves every
+ * connection whose resource it covers, so listing the agent's resources on one
+ * connection yields one sign-in.
  *
- * Discovery is memoized per definition, so the first authorization pays the
- * metadata round trip and later ones do not. Registration is not memoized —
- * the redirect URI it binds is different every time.
+ * Discovery is memoized per definition. Registration is not, because the
+ * redirect URI it binds is different every time.
  */
 export declare function interactive(options: KeycardInteractiveOptions): InteractiveAuthorizationDefinition<KeycardResumeState>;
-/** A process-local store that drops entries at their advisory expiry. */
-export declare function memoryAuthorizedTokenStore(): AuthorizedTokenStore;
+/** A process-local store that drops grants once they can no longer mint a token. */
+export declare function memoryAuthorizedTokenStore(): GrantStore;
 //# sourceMappingURL=interactive.d.ts.map

package/dist/esm/interactive.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interactive.d.ts","sourceRoot":"","sources":["../../src/interactive.ts"],"names":[],"mappings":"AAAA,OAAO,EAQL,KAAK,qBAAqB,EAC1B,KAAK,yBAAyB,EAC9B,KAAK,4BAA4B,EAEjC,KAAK,aAAa,EACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAEV,kCAAkC,EAClC,SAAS,EAEV,MAAM,iBAAiB,CAAC;AAUzB;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,+EAA+E;AAC/E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAAC;IAC9C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,IAAI,CAAC;IAC/C,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,qEAAqE;AACrE,MAAM,WAAW,4BAA4B;IAC3C,2EAA2E;IAC3E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,iDAAiD;IACjD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,gEAAgE;AAChE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,oEAAoE;AACpE,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC1E,QAAQ,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACxE;;;OAGG;IACH,QAAQ,CAAC,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CAC7E;AAED,MAAM,WAAW,yBAAyB;IACxC,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,qDAAqD;IACrD,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IAC3C,uDAAuD;IACvD,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,kEAAkE;IAClE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B,wEAAwE;IACxE,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,yBAAyB,GACjC,kCAAkC,CAAC,kBAAkB,CAAC,CAoKxD;AAED,yEAAyE;AACzE,wBAAgB,0BAA0B,IAAI,oBAAoB,CAmBjE"}
+{"version":3,"file":"interactive.d.ts","sourceRoot":"","sources":["../../src/interactive.ts"],"names":[],"mappings":"AAAA,OAAO,EAUL,KAAK,qBAAqB,EAC1B,KAAK,yBAAyB,EAC9B,KAAK,4BAA4B,EAEjC,KAAK,2BAA2B,EAChC,KAAK,aAAa,EACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAEV,kCAAkC,EAClC,SAAS,EAEV,MAAM,iBAAiB,CAAC;AAazB;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,eAAe,EAAE,CAAC,CAAC;IAC7D,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3D;AAED,qEAAqE;AACrE,MAAM,WAAW,4BAA4B;IAC3C,2EAA2E;IAC3E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,iDAAiD;IACjD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,gEAAgE;AAChE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,oEAAoE;AACpE,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC1E,QAAQ,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACxE;;;OAGG;IACH,QAAQ,CAAC,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC5E;;;OAGG;IACH,OAAO,CAAC,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CACxE;AAED,MAAM,WAAW,yBAAyB;IACxC,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IAC3C;;;OAGG;IACH,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qEAAqE;IACrE,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,wEAAwE;IACxE,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAKD,yEAAyE;AACzE,wBAAgB,2BAA2B,IAAI,IAAI,CAElD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,yBAAyB,GACjC,kCAAkC,CAAC,kBAAkB,CAAC,CA0QxD;AAED,oFAAoF;AACpF,wBAAgB,0BAA0B,IAAI,UAAU,CAwBvD"}

package/dist/esm/interactive.js

@@ -1,49 +1,57 @@
-import { AuthProviderConfigurationError, AuthorizationDeniedError, beginAuthorization, completeAuthorization, fetchAuthorizationServerMetadata, registerClient, StateMismatchError, } from "@keycardai/oauth";
+import { AuthProviderConfigurationError, AuthorizationDeniedError, beginAuthorization, completeAuthorization, fetchAuthorizationServerMetadata, refreshAuthorization, RefreshGrantError, registerClient, StateMismatchError, } from "@keycardai/oauth";
 import { expiresAt } from "./config.js";
 import { AuthorizationFailedError, AuthorizationRequiredError, FailureReason, } from "./errors.js";
 import { principalKey } from "./subjectTokens.js";
+/** A grant is refreshed once it is this close to its advisory expiry. */
+const REFRESH_SKEW_MS = 60_000;
+/** Connection names taken by `interactive()` definitions in this process. */
+const definedConnectionNames = new Set();
+/** Forgets every defined connection name. For tests that define many. */
+export function resetInteractiveDefinitions() {
+    definedConnectionNames.clear();
+}
 /**
  * Interactive connection auth backed by the zone's web authorization flow.
  *
  * The three callbacks eve drives:
  *
- * - `getToken` returns a token only when this package holds one for the
- *   principal. Otherwise it throws `ConnectionAuthorizationRequiredError`, and
- *   eve emits `authorization.required`, runs `startAuthorization` in a durable
- *   step, and parks the turn on its own callback webhook.
- * - `startAuthorization` begins the authorization-code flow with PKCE for the
- *   connection's resources, against eve's minted callback URL, and returns the
- *   challenge URL plus the `state` and verifier as resume state.
- * - `completeAuthorization` redeems the callback against the journaled resume
- *   state and hands eve the token.
+ * - `getToken` returns a token when the store holds a grant for the principal
+ *   whose resources cover this connection's resource and whose scopes cover
+ *   `requestScopes`, refreshing it first when it is near expiry and holds a
+ *   refresh token. Otherwise it throws `ConnectionAuthorizationRequiredError`,
+ *   and eve emits `authorization.required`, runs `startAuthorization` in a
+ *   durable step, and parks the turn on its own callback webhook.
+ * - `startAuthorization` registers the attempt's client, begins the
+ *   authorization-code flow with PKCE for the connection's resources against
+ *   eve's minted callback URL, and returns the challenge URL plus the state,
+ *   verifier, resources, callback URL and client id as resume state.
+ * - `completeAuthorization` redeems the callback as the journaled client and
+ *   stores the resulting grant.
  *
- * Resuming without a completed authorization cannot yield a credential.
- * `getToken` is the only path that returns a token and it reads the store,
- * which only `completeAuthorization` writes; a denied, mismatched, or failed
- * callback writes nothing. So a resumed turn either finds a real grant or
- * throws `Required` again and parks. eve's own settlement makes that terminal
- * rather than an endless loop: it settles each parked authorization once, and
- * a `Required` thrown after a completed authorization ends the tool call.
+ * Resuming without a completed authorization cannot yield a credential: only
+ * `completeAuthorization` writes the store, and a denied, mismatched, or failed
+ * callback writes nothing, so a resumed turn either finds a real grant or parks
+ * again. eve settles each parked authorization once, so that is terminal rather
+ * than a loop.
  *
- * THE CLIENT IS REGISTERED PER ATTEMPT unless `clientId` says otherwise, and
- * that is not an optimization — it is what makes the flow work at all. eve
- * mints a fresh callback URL for every attempt, carrying the attempt id and a
- * run token in its path, while RFC 9700 requires the authorization server to
- * match `redirect_uri` against the client's registered list by exact string
- * comparison. No fixed registration can name a URL that is generated later, so
- * a static client and a dynamic callback cannot both hold. Registering the
- * client alongside the callback it belongs to resolves it: each attempt gets a
- * public, PKCE-bound client whose one redirect URI is the one URL that attempt
- * will return to.
+ * The client is registered per attempt unless `clientId` is set. eve mints a
+ * fresh callback URL for every attempt, while RFC 9700 requires the
+ * authorization server to match `redirect_uri` against the client's registered
+ * list by exact string comparison, so no fixed registration can name a URL that
+ * is generated later. Each attempt therefore gets a public, PKCE-bound client
+ * whose one redirect URI is the callback that attempt returns to. Those client
+ * records accumulate in the zone; a server that returns
+ * `registration_client_uri` and `registration_access_token` allows RFC 7592
+ * deletion once a grant settles.
  *
- * Each attempt therefore leaves a client record in the zone. They are public,
- * hold no secret, and are bound to a callback URL that is single-use, but they
- * do accumulate; a server that returns `registration_client_uri` and
- * `registration_access_token` allows RFC 7592 deletion once a grant settles.
+ * Grants are keyed by principal, never by `connectionName`, so two connections
+ * never share a token through a shared name and `evict` on one cannot clear the
+ * other's grant. A grant obtained with `additionalResources` serves every
+ * connection whose resource it covers, so listing the agent's resources on one
+ * connection yields one sign-in.
  *
- * Discovery is memoized per definition, so the first authorization pays the
- * metadata round trip and later ones do not. Registration is not memoized —
- * the redirect URI it binds is different every time.
+ * Discovery is memoized per definition. Registration is not, because the
+ * redirect URI it binds is different every time.
  */
 export function interactive(options) {
     if (!options.resource || !options.resource.trim()) {
@@ -53,6 +61,10 @@ export function interactive(options) {
         throw new AuthProviderConfigurationError("interactive requires zoneUrl, or an injected flow");
     }
     const connectionName = options.connectionName ?? options.resource;
+    if (definedConnectionNames.has(connectionName)) {
+        throw new AuthProviderConfigurationError(`interactive connectionName "${connectionName}" is already defined in this process. ` +
+            "The name is display text, not a token key, so give each connection its own.");
+    }
     const tokens = options.tokens ?? memoryAuthorizedTokenStore();
     const flow = options.flow ??
         zoneWebAppFlow(options.zoneUrl, {
@@ -68,6 +80,9 @@ export function interactive(options) {
         throw new AuthProviderConfigurationError("interactive was given no clientId, so it registers a client per attempt, but the " +
             "injected flow has no register()");
     }
+    definedConnectionNames.add(connectionName);
+    const covers = (grant) => grant.resources.includes(options.resource) &&
+        scopes.every((scope) => grant.scopes.includes(scope));
     /**
      * The client this attempt runs as: the configured one, or a fresh public
      * client whose single redirect URI is this attempt's callback.
@@ -104,26 +119,94 @@ export function interactive(options) {
         }
         return registered.clientId;
     };
+    /** A per-attempt client is public; only the static client can hold a secret. */
+    const secretFor = (clientId) => staticClientId && clientId === staticClientId && options.clientSecret
+        ? { clientSecret: options.clientSecret }
+        : {};
+    /**
+     * Refreshes a near-expiry grant as the client it was issued to. A refused
+     * refresh drops the grant so the caller parks for a fresh sign-in.
+     */
+    const refreshGrant = async (principal, grant) => {
+        let response;
+        try {
+            response = await flow.refresh({
+                refreshToken: grant.refreshToken,
+                clientId: grant.clientId,
+                resources: grant.resources,
+                ...(grant.scopes.length > 0 ? { scopes: grant.scopes } : {}),
+                ...secretFor(grant.clientId),
+            });
+        }
+        catch (cause) {
+            if (cause instanceof RefreshGrantError &&
+                cause.errorCode === "invalid_grant") {
+                // A concurrent step may have rotated this grant first, in which case
+                // the refresh token we sent is the stale one and the stored grant is
+                // the good one.
+                const current = (await tokens.list(principal)).find((candidate) => candidate.id === grant.id);
+                if (current && current.refreshToken !== grant.refreshToken) {
+                    return current;
+                }
+                await tokens.remove(principal, grant.id);
+                throw new AuthorizationRequiredError(connectionName, {
+                    message: `Connection "${connectionName}" requires authorization: the zone refused to ` +
+                        `refresh the grant (${cause.message}).`,
+                });
+            }
+            throw new AuthorizationFailedError(connectionName, {
+                message: cause instanceof Error
+                    ? `Refreshing the grant failed: ${cause.message}`
+                    : "Refreshing the grant failed",
+                reason: FailureReason.ACQUISITION_FAILED,
+                retryable: cause instanceof RefreshGrantError ? cause.retryable : true,
+            });
+        }
+        const rotated = grantFromResponse(response, {
+            id: grant.id,
+            clientId: grant.clientId,
+            resources: grant.resources,
+            scopes: grant.scopes,
+            // A server that rotates nothing leaves the old refresh token valid.
+            refreshToken: grant.refreshToken,
+        });
+        await tokens.put(principal, rotated);
+        return rotated;
+    };
     return {
         principalType: "user",
         /**
-         * NO definition-level `displayName`. eve validates an authored connection's
-         * `auth` against a closed key list (`completeAuthorization`, `evict`,
-         * `getToken`, `principalType`, `startAuthorization`, `vercelConnect`) that
-         * omits it, so setting it here fails the BUILD with
-         * `The "auth" field Unknown key "displayName"` for every interactive
-         * connection. The name still reaches the sign-in prompt: it rides on the
-         * challenge below, and eve's `stampChallengeDisplayName` resolves
-         * `definition.displayName ?? challenge.displayName`. The definition-level
-         * field was only ever a precedence override of a value already carried.
+         * No definition-level `displayName`: eve validates an authored connection's
+         * `auth` against a closed key list (`completeAuthorization`,
+         * `credentialOwner`, `evict`, `getToken`, `principalType`,
+         * `startAuthorization`, `vercelConnect`) that omits it. The name rides on the challenge instead, where eve's
+         * `stampChallengeDisplayName` falls back to it.
          */
         async getToken({ principal }) {
-            const key = storeKey(principal, connectionName);
-            const held = tokens.get(key);
-            if (!held) {
+            const key = storeKey(principal);
+            const now = Date.now();
+            const held = (await tokens.list(key)).filter(covers);
+            // A grant is usable while its access token is live or while it holds a
+            // refresh token that can mint a new one; an expired grant with no refresh
+            // token is dead.
+            const usable = held.filter((candidate) => !dead(candidate, now));
+            let grant = usable.find((candidate) => !expired(candidate, now)) ?? usable[0];
+            if (!grant) {
+                await Promise.all(held.map((stale) => tokens.remove(key, stale.id)));
+                throw new AuthorizationRequiredError(connectionName);
+            }
+            if (nearExpiry(grant, now) && grant.refreshToken && flow.refresh) {
+                grant = await refreshGrant(key, {
+                    ...grant,
+                    refreshToken: grant.refreshToken,
+                });
+            }
+            else if (expired(grant, now)) {
+                // Expired, and this flow cannot refresh it.
+                await tokens.remove(key, grant.id);
                 throw new AuthorizationRequiredError(connectionName);
             }
-            return toTokenResult(held);
+            return toTokenResult(grant);
         },
         async startAuthorization({ principal, callbackUrl }) {
             requireUser(principal, connectionName);
@@ -155,21 +238,18 @@ export function interactive(options) {
                     retryable: false,
                 });
             }
+            // The attempt's own client, falling back to the configured one for a
+            // resume journaled before clientId existed.
+            const clientId = resume.clientId || staticClientId;
             let response;
             try {
                 response = await flow.complete({
                     callbackParams: { ...callback.params },
                     state: resume.state,
                     codeVerifier: resume.codeVerifier,
-                    // The attempt's own client. Falls back to the configured one for a
-                    // resume journaled before this field existed.
-                    clientId: resume.clientId || staticClientId,
+                    clientId,
                     redirectUri: resume.callbackUrl || callbackUrl,
-                    // Only a static client can be confidential; a per-attempt client is
-                    // always public, so there is no secret to send.
-                    ...(staticClientId && options.clientSecret
-                        ? { clientSecret: options.clientSecret }
-                        : {}),
+                    ...secretFor(clientId),
                 });
             }
             catch (cause) {
@@ -183,42 +263,54 @@ export function interactive(options) {
                     retryable: false,
                 });
             }
-            const expiry = expiresAt(response.expiresIn);
-            const token = {
-                token: response.accessToken,
-                ...(expiry !== undefined ? { expiresAt: expiry } : {}),
-            };
-            tokens.set(storeKey(principal, connectionName), token);
-            return toTokenResult(token);
+            const grant = grantFromResponse(response, {
+                id: crypto.randomUUID(),
+                clientId,
+                resources: resume.resources.length > 0 ? resume.resources : resources,
+                scopes,
+            });
+            await tokens.put(storeKey(principal), grant);
+            return toTokenResult(grant);
         },
         /**
-         * eve calls this after a rejected bearer, so the next `getToken` parks the
-         * turn for a fresh grant instead of handing back the same dead token.
+         * eve calls this after a rejected bearer. Every grant covering this
+         * connection's resource goes, so the next `getToken` parks for a fresh one;
+         * grants for other resources stay.
          */
-        evict({ principal }) {
-            tokens.delete(storeKey(principal, connectionName));
+        async evict({ principal }) {
+            const key = storeKey(principal);
+            const held = await tokens.list(key);
+            await Promise.all(held
+                .filter((grant) => grant.resources.includes(options.resource))
+                .map((grant) => tokens.remove(key, grant.id)));
         },
     };
 }
-/** A process-local store that drops entries at their advisory expiry. */
+/** A process-local store that drops grants once they can no longer mint a token. */
 export function memoryAuthorizedTokenStore() {
-    const tokens = new Map();
+    const grants = new Map();
     return {
-        get(key) {
-            const held = tokens.get(key);
+        async list(principal) {
+            const held = grants.get(principal);
             if (!held)
-                return undefined;
-            if (held.expiresAt !== undefined && held.expiresAt <= Date.now()) {
-                tokens.delete(key);
-                return undefined;
+                return [];
+            const now = Date.now();
+            for (const [id, grant] of held) {
+                if (dead(grant, now))
+                    held.delete(id);
             }
-            return held;
+            return [...held.values()];
         },
-        set(key, token) {
-            tokens.set(key, token);
+        async put(principal, grant) {
+            let held = grants.get(principal);
+            if (!held) {
+                held = new Map();
+                grants.set(principal, held);
+            }
+            held.set(grant.id, grant);
         },
-        delete(key) {
-            tokens.delete(key);
+        async remove(principal, grantId) {
+            grants.get(principal)?.delete(grantId);
         },
     };
 }
@@ -232,20 +324,29 @@ function zoneWebAppFlow(issuer, options = {}) {
     };
     return {
         async begin(beginOptions) {
-            return beginAuthorization(issuer, { ...beginOptions, metadata: await discover() });
+            return beginAuthorization(issuer, {
+                ...beginOptions,
+                metadata: await discover(),
+            });
         },
         async complete(completeOptions) {
-            return completeAuthorization(issuer, { ...completeOptions, metadata: await discover() });
+            return completeAuthorization(issuer, {
+                ...completeOptions,
+                metadata: await discover(),
+            });
+        },
+        async refresh(refreshOptions) {
+            return refreshAuthorization(issuer, {
+                ...refreshOptions,
+                metadata: await discover(),
+            });
         },
         /**
          * One public, PKCE-bound client per authorization, holding the single
-         * redirect URI that attempt will actually come back to.
-         *
-         * `token_endpoint_auth_method: "none"` is what keeps the resume state free
-         * of credentials: a public client has no secret to journal, and the code is
-         * bound to the PKCE verifier instead. `refresh_token` is requested so a
-         * long-lived grant can be renewed without sending the user back through the
-         * browser.
+         * redirect URI that attempt will come back to. `token_endpoint_auth_method:
+         * "none"` keeps the resume state free of credentials, and `refresh_token`
+         * is requested so a long-lived grant can be renewed without sending the
+         * user back through the browser.
          */
         async register({ redirectUri, clientName, scopes }) {
             const registered = await registerClient(issuer, {
@@ -267,18 +368,43 @@ function zoneWebAppFlow(issuer, options = {}) {
         },
     };
 }
-function storeKey(principal, connectionName) {
+/**
+ * The grant a token response settles. The server's `scope` is authoritative
+ * when present; otherwise the scopes are the ones requested (RFC 6749 section
+ * 5.1 lets the server omit `scope` when it granted exactly those).
+ */
+function grantFromResponse(response, issued) {
+    const expiry = expiresAt(response.expiresIn);
+    const refreshToken = response.refreshToken ?? issued.refreshToken;
+    return {
+        id: issued.id,
+        accessToken: response.accessToken,
+        ...(expiry !== undefined ? { expiresAt: expiry } : {}),
+        ...(refreshToken !== undefined ? { refreshToken } : {}),
+        clientId: issued.clientId,
+        resources: [...issued.resources],
+        scopes: response.scope ? splitScopes(response.scope) : [...issued.scopes],
+    };
+}
+function expired(grant, now) {
+    return grant.expiresAt !== undefined && grant.expiresAt <= now;
+}
+/** Expired with no refresh token: nothing can mint a new access token. */
+function dead(grant, now) {
+    return expired(grant, now) && !grant.refreshToken;
+}
+function nearExpiry(grant, now) {
+    return (grant.expiresAt !== undefined && grant.expiresAt - REFRESH_SKEW_MS <= now);
+}
+function storeKey(principal) {
     if (principal.type !== "user")
-        return `${connectionName}|app`;
-    return `${connectionName}|${principalKey(principal)}`;
+        return "app";
+    return principalKey(principal);
 }
-function toTokenResult(token) {
+function toTokenResult(grant) {
     return {
-        token: token.token,
-        ...(token.expiresAt !== undefined ? { expiresAt: token.expiresAt } : {}),
-        ...(token.providerSubject !== undefined
-            ? { providerSubject: token.providerSubject }
-            : {}),
+        token: grant.accessToken,
+        ...(grant.expiresAt !== undefined ? { expiresAt: grant.expiresAt } : {}),
     };
 }
 function requireUser(principal, connectionName) {
@@ -294,6 +420,8 @@ function requireUser(principal, connectionName) {
 function splitScopes(scopes) {
     if (scopes === undefined)
         return [];
-    return Array.isArray(scopes) ? [...scopes] : scopes.split(" ").filter(Boolean);
+    return Array.isArray(scopes)
+        ? [...scopes]
+        : scopes.split(" ").filter(Boolean);
 }
 //# sourceMappingURL=interactive.js.map

package/dist/esm/interactive.js.map

@@ -1 +1 @@
-{"version":3,"file":"interactive.js","sourceRoot":"","sources":["../../src/interactive.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,wBAAwB,EACxB,kBAAkB,EAClB,qBAAqB,EACrB,gCAAgC,EAChC,cAAc,EACd,kBAAkB,GAMnB,MAAM,kBAAkB,CAAC;AAQ1B,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AA2HlD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,UAAU,WAAW,CACzB,OAAkC;IAElC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,8BAA8B,CAAC,qCAAqC,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACtC,MAAM,IAAI,8BAA8B,CAAC,mDAAmD,CAAC,CAAC;IAChG,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,QAAQ,CAAC;IAClE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,0BAA0B,EAAE,CAAC;IAC9D,MAAM,IAAI,GACR,OAAO,CAAC,IAAI;QACZ,cAAc,CAAC,OAAO,CAAC,OAAQ,EAAE;YAC/B,GAAG,CAAC,OAAO,CAAC,kBAAkB,KAAK,SAAS;gBAC1C,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE;gBACpD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;IACL,MAAM,cAAc,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;IAC9C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,cAAc,CAAC;IACxD,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAElD,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,8BAA8B,CACtC,mFAAmF;YACjF,iCAAiC,CACpC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,MAAM,gBAAgB,GAAG,KAAK,EAAE,WAAmB,EAAmB,EAAE;QACtE,IAAI,cAAc;YAAE,OAAO,cAAc,CAAC;QAC1C,IAAI,UAA4B,CAAC;QACjC,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,IAAI,CAAC,QAAS,CAAC;gBAChC,WAAW,EAAE,WAAW;gBACxB,UAAU;gBACV,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;gBACjD,OAAO,EACL,KAAK,YAAY,KAAK;oBACpB,CAAC,CAAC,+DAA+D,KAAK,CAAC,OAAO,EAAE;oBAChF,CAAC,CAAC,4DAA4D;gBAClE,MAAM,EAAE,aAAa,CAAC,kBAAkB;gBACxC,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,UAAU,CAAC,YAAY,EAAE,CAAC;YAC5B,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;gBACjD,OAAO,EACL,6EAA6E;oBAC7E,gFAAgF;oBAChF,gFAAgF;oBAChF,sCAAsC;gBACxC,MAAM,EAAE,aAAa,CAAC,kBAAkB;gBACxC,SAAS,EAAE,KAAK;aACjB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,UAAU,CAAC,QAAQ,CAAC;IAC7B,CAAC,CAAC;IAEF,OAAO;QACL,aAAa,EAAE,MAAM;QACrB;;;;;;;;;;WAUG;QACH,KAAK,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE;YAC1B,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;YAChD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,0BAA0B,CAAC,cAAc,CAAC,CAAC;YACvD,CAAC;YACD,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QACD,KAAK,CAAC,kBAAkB,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE;YACjD,WAAW,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;YACvC,MAAM,eAAe,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAC5D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC;gBAChC,QAAQ,EAAE,eAAe;gBACzB,WAAW,EAAE,WAAW;gBACxB,SAAS;gBACT,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzC,CAAC,CAAC;YACH,OAAO;gBACL,SAAS,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,WAAW,EAAE,cAAc,EAAE;gBAC7D,MAAM,EAAE;oBACN,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,YAAY,EAAE,QAAQ,CAAC,YAAY;oBACnC,SAAS,EAAE,QAAQ,CAAC,SAAS;oBAC7B,WAAW;oBACX,QAAQ,EAAE,eAAe;iBAC1B;aACF,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE;YACtE,WAAW,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;YACvC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;oBACjD,OAAO,EACL,wEAAwE;wBACxE,uCAAuC;oBACzC,MAAM,EAAE,aAAa,CAAC,gBAAgB;oBACtC,SAAS,EAAE,KAAK;iBACjB,CAAC,CAAC;YACL,CAAC;YAED,IAAI,QAAuB,CAAC;YAC5B,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;oBAC7B,cAAc,EAAE,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE;oBACtC,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,mEAAmE;oBACnE,8CAA8C;oBAC9C,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,cAAc;oBAC3C,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,WAAW;oBAC9C,oEAAoE;oBACpE,gDAAgD;oBAChD,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC,YAAY;wBACxC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE;wBACxC,CAAC,CAAC,EAAE,CAAC;iBACR,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;oBACjD,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB;oBACxE,MAAM,EACJ,KAAK,YAAY,wBAAwB;wBACvC,CAAC,CAAC,aAAa,CAAC,aAAa;wBAC7B,CAAC,CAAC,KAAK,YAAY,kBAAkB;4BACnC,CAAC,CAAC,aAAa,CAAC,gBAAgB;4BAChC,CAAC,CAAC,aAAa,CAAC,kBAAkB;oBACxC,SAAS,EAAE,KAAK;iBACjB,CAAC,CAAC;YACL,CAAC;YAED,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAoB;gBAC7B,KAAK,EAAE,QAAQ,CAAC,WAAW;gBAC3B,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvD,CAAC;YACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE,KAAK,CAAC,CAAC;YACvD,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;QACD;;;WAGG;QACH,KAAK,CAAC,EAAE,SAAS,EAAE;YACjB,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;QACrD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,0BAA0B;IACxC,MAAM,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAC;IAClD,OAAO;QACL,GAAG,CAAC,GAAG;YACL,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,CAAC,IAAI;gBAAE,OAAO,SAAS,CAAC;YAC5B,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACjE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACnB,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,GAAG,CAAC,GAAG,EAAE,KAAK;YACZ,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACzB,CAAC;QACD,MAAM,CAAC,GAAG;YACR,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,SAAS,cAAc,CACrB,MAAc,EACd,UAA2C,EAAE;IAE7C,IAAI,QAA+D,CAAC;IACpE,MAAM,QAAQ,GAAG,GAA8C,EAAE;QAC/D,IAAI,CAAC,QAAQ;YAAE,QAAQ,GAAG,gCAAgC,CAAC,MAAM,CAAC,CAAC;QACnE,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,YAAY;YACtB,OAAO,kBAAkB,CAAC,MAAM,EAAE,EAAE,GAAG,YAAY,EAAE,QAAQ,EAAE,MAAM,QAAQ,EAAE,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,eAAe;YAC5B,OAAO,qBAAqB,CAAC,MAAM,EAAE,EAAE,GAAG,eAAe,EAAE,QAAQ,EAAE,MAAM,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD;;;;;;;;;WASG;QACH,KAAK,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE;YAChD,MAAM,UAAU,GAAG,MAAM,cAAc,CACrC,MAAM,EACN;gBACE,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnD,YAAY,EAAE,CAAC,WAAW,CAAC;gBAC3B,UAAU,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;gBACnD,aAAa,EAAE,CAAC,MAAM,CAAC;gBACvB,uBAAuB,EAAE,MAAM;gBAC/B,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpE,EACD,OAAO,CAAC,kBAAkB,KAAK,SAAS;gBACtC,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE;gBACpD,CAAC,CAAC,SAAS,CACd,CAAC;YACF,OAAO;gBACL,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,GAAG,CAAC,UAAU,CAAC,YAAY,KAAK,SAAS;oBACvC,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE;oBAC3C,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,SAA8B,EAAE,cAAsB;IACtE,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,GAAG,cAAc,MAAM,CAAC;IAC9D,OAAO,GAAG,cAAc,IAAI,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,aAAa,CAAC,KAAsB;IAC3C,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,KAAK,CAAC,eAAe,KAAK,SAAS;YACrC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE;YAC5C,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,SAA8B,EAAE,cAAsB;IACzE,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO;IACtC,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;QACjD,OAAO,EACL,6EAA6E;YAC7E,wBAAwB;QAC1B,MAAM,EAAE,aAAa,CAAC,kBAAkB;QACxC,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,MAA8C;IACjE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACpC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAE,MAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC7F,CAAC"}
+{"version":3,"file":"interactive.js","sourceRoot":"","sources":["../../src/interactive.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,wBAAwB,EACxB,kBAAkB,EAClB,qBAAqB,EACrB,gCAAgC,EAChC,oBAAoB,EACpB,iBAAiB,EACjB,cAAc,EACd,kBAAkB,GAOnB,MAAM,kBAAkB,CAAC;AAQ1B,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,yEAAyE;AACzE,MAAM,eAAe,GAAG,MAAM,CAAC;AAkJ/B,6EAA6E;AAC7E,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAU,CAAC;AAEjD,yEAAyE;AACzE,MAAM,UAAU,2BAA2B;IACzC,sBAAsB,CAAC,KAAK,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,UAAU,WAAW,CACzB,OAAkC;IAElC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,8BAA8B,CACtC,qCAAqC,CACtC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACtC,MAAM,IAAI,8BAA8B,CACtC,mDAAmD,CACpD,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,QAAQ,CAAC;IAClE,IAAI,sBAAsB,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,8BAA8B,CACtC,+BAA+B,cAAc,wCAAwC;YACnF,6EAA6E,CAChF,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,0BAA0B,EAAE,CAAC;IAC9D,MAAM,IAAI,GACR,OAAO,CAAC,IAAI;QACZ,cAAc,CAAC,OAAO,CAAC,OAAQ,EAAE;YAC/B,GAAG,CAAC,OAAO,CAAC,kBAAkB,KAAK,SAAS;gBAC1C,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE;gBACpD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;IACL,MAAM,cAAc,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;IAC9C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,cAAc,CAAC;IACxD,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAElD,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,8BAA8B,CACtC,mFAAmF;YACjF,iCAAiC,CACpC,CAAC;IACJ,CAAC;IACD,sBAAsB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAE3C,MAAM,MAAM,GAAG,CAAC,KAAsB,EAAW,EAAE,CACjD,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC1C,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAExD;;;OAGG;IACH,MAAM,gBAAgB,GAAG,KAAK,EAAE,WAAmB,EAAmB,EAAE;QACtE,IAAI,cAAc;YAAE,OAAO,cAAc,CAAC;QAC1C,IAAI,UAA4B,CAAC;QACjC,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,IAAI,CAAC,QAAS,CAAC;gBAChC,WAAW,EAAE,WAAW;gBACxB,UAAU;gBACV,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;gBACjD,OAAO,EACL,KAAK,YAAY,KAAK;oBACpB,CAAC,CAAC,+DAA+D,KAAK,CAAC,OAAO,EAAE;oBAChF,CAAC,CAAC,4DAA4D;gBAClE,MAAM,EAAE,aAAa,CAAC,kBAAkB;gBACxC,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,UAAU,CAAC,YAAY,EAAE,CAAC;YAC5B,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;gBACjD,OAAO,EACL,6EAA6E;oBAC7E,gFAAgF;oBAChF,gFAAgF;oBAChF,sCAAsC;gBACxC,MAAM,EAAE,aAAa,CAAC,kBAAkB;gBACxC,SAAS,EAAE,KAAK;aACjB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,UAAU,CAAC,QAAQ,CAAC;IAC7B,CAAC,CAAC;IAEF,gFAAgF;IAChF,MAAM,SAAS,GAAG,CAChB,QAAgB,EACiC,EAAE,CACnD,cAAc,IAAI,QAAQ,KAAK,cAAc,IAAI,OAAO,CAAC,YAAY;QACnE,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE;QACxC,CAAC,CAAC,EAAE,CAAC;IAET;;;OAGG;IACH,MAAM,YAAY,GAAG,KAAK,EACxB,SAAiB,EACjB,KAAiD,EACvB,EAAE;QAC5B,IAAI,QAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAQ,CAAC;gBAC7B,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC;aAC7B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IACE,KAAK,YAAY,iBAAiB;gBAClC,KAAK,CAAC,SAAS,KAAK,eAAe,EACnC,CAAC;gBACD,qEAAqE;gBACrE,qEAAqE;gBACrE,gBAAgB;gBAChB,MAAM,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CACjD,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CACzC,CAAC;gBACF,IAAI,OAAO,IAAI,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,EAAE,CAAC;oBAC3D,OAAO,OAAO,CAAC;gBACjB,CAAC;gBACD,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;gBACzC,MAAM,IAAI,0BAA0B,CAAC,cAAc,EAAE;oBACnD,OAAO,EACL,eAAe,cAAc,gDAAgD;wBAC7E,sBAAsB,KAAK,CAAC,OAAO,IAAI;iBAC1C,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;gBACjD,OAAO,EACL,KAAK,YAAY,KAAK;oBACpB,CAAC,CAAC,gCAAgC,KAAK,CAAC,OAAO,EAAE;oBACjD,CAAC,CAAC,6BAA6B;gBACnC,MAAM,EAAE,aAAa,CAAC,kBAAkB;gBACxC,SAAS,EAAE,KAAK,YAAY,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;aACvE,CAAC,CAAC;QACL,CAAC;QACD,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,EAAE;YAC1C,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,oEAAoE;YACpE,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACrC,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,OAAO;QACL,aAAa,EAAE,MAAM;QACrB;;;;;;WAMG;QACH,KAAK,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE;YAC1B,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;YAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACrD,uEAAuE;YACvE,0EAA0E;YAC1E,iBAAiB;YACjB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;YACjE,IAAI,KAAK,GACP,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;YACpE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBACrE,MAAM,IAAI,0BAA0B,CAAC,cAAc,CAAC,CAAC;YACvD,CAAC;YACD,IAAI,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACjE,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE;oBAC9B,GAAG,KAAK;oBACR,YAAY,EAAE,KAAK,CAAC,YAAY;iBACjC,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;gBAC/B,4CAA4C;gBAC5C,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;gBACnC,MAAM,IAAI,0BAA0B,CAAC,cAAc,CAAC,CAAC;YACvD,CAAC;YACD,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,CAAC,kBAAkB,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE;YACjD,WAAW,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;YACvC,MAAM,eAAe,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAC5D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC;gBAChC,QAAQ,EAAE,eAAe;gBACzB,WAAW,EAAE,WAAW;gBACxB,SAAS;gBACT,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzC,CAAC,CAAC;YACH,OAAO;gBACL,SAAS,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,WAAW,EAAE,cAAc,EAAE;gBAC7D,MAAM,EAAE;oBACN,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,YAAY,EAAE,QAAQ,CAAC,YAAY;oBACnC,SAAS,EAAE,QAAQ,CAAC,SAAS;oBAC7B,WAAW;oBACX,QAAQ,EAAE,eAAe;iBAC1B;aACF,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE;YACtE,WAAW,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;YACvC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;oBACjD,OAAO,EACL,wEAAwE;wBACxE,uCAAuC;oBACzC,MAAM,EAAE,aAAa,CAAC,gBAAgB;oBACtC,SAAS,EAAE,KAAK;iBACjB,CAAC,CAAC;YACL,CAAC;YAED,qEAAqE;YACrE,4CAA4C;YAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,cAAc,CAAC;YACnD,IAAI,QAAuB,CAAC;YAC5B,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;oBAC7B,cAAc,EAAE,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE;oBACtC,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,QAAQ;oBACR,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,WAAW;oBAC9C,GAAG,SAAS,CAAC,QAAQ,CAAC;iBACvB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;oBACjD,OAAO,EACL,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB;oBACjE,MAAM,EACJ,KAAK,YAAY,wBAAwB;wBACvC,CAAC,CAAC,aAAa,CAAC,aAAa;wBAC7B,CAAC,CAAC,KAAK,YAAY,kBAAkB;4BACnC,CAAC,CAAC,aAAa,CAAC,gBAAgB;4BAChC,CAAC,CAAC,aAAa,CAAC,kBAAkB;oBACxC,SAAS,EAAE,KAAK;iBACjB,CAAC,CAAC;YACL,CAAC;YAED,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,EAAE;gBACxC,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;gBACvB,QAAQ;gBACR,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;gBACrE,MAAM;aACP,CAAC,CAAC;YACH,MAAM,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;YAC7C,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;QACD;;;;WAIG;QACH,KAAK,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE;YACvB,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;YAChC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACpC,MAAM,OAAO,CAAC,GAAG,CACf,IAAI;iBACD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;iBAC7D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAChD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,0BAA0B;IACxC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwC,CAAC;IAC/D,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,SAAS;YAClB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACnC,IAAI,CAAC,IAAI;gBAAE,OAAO,EAAE,CAAC;YACrB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;gBAC/B,IAAI,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC;oBAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACxC,CAAC;YACD,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5B,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK;YACxB,IAAI,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACjC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC;gBACjB,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YAC9B,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC5B,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO;YAC7B,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACzC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,SAAS,cAAc,CACrB,MAAc,EACd,UAA2C,EAAE;IAE7C,IAAI,QAA+D,CAAC;IACpE,MAAM,QAAQ,GAAG,GAA8C,EAAE;QAC/D,IAAI,CAAC,QAAQ;YAAE,QAAQ,GAAG,gCAAgC,CAAC,MAAM,CAAC,CAAC;QACnE,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,YAAY;YACtB,OAAO,kBAAkB,CAAC,MAAM,EAAE;gBAChC,GAAG,YAAY;gBACf,QAAQ,EAAE,MAAM,QAAQ,EAAE;aAC3B,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,eAAe;YAC5B,OAAO,qBAAqB,CAAC,MAAM,EAAE;gBACnC,GAAG,eAAe;gBAClB,QAAQ,EAAE,MAAM,QAAQ,EAAE;aAC3B,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,cAAc;YAC1B,OAAO,oBAAoB,CAAC,MAAM,EAAE;gBAClC,GAAG,cAAc;gBACjB,QAAQ,EAAE,MAAM,QAAQ,EAAE;aAC3B,CAAC,CAAC;QACL,CAAC;QACD;;;;;;WAMG;QACH,KAAK,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE;YAChD,MAAM,UAAU,GAAG,MAAM,cAAc,CACrC,MAAM,EACN;gBACE,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnD,YAAY,EAAE,CAAC,WAAW,CAAC;gBAC3B,UAAU,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;gBACnD,aAAa,EAAE,CAAC,MAAM,CAAC;gBACvB,uBAAuB,EAAE,MAAM;gBAC/B,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpE,EACD,OAAO,CAAC,kBAAkB,KAAK,SAAS;gBACtC,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE;gBACpD,CAAC,CAAC,SAAS,CACd,CAAC;YACF,OAAO;gBACL,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,GAAG,CAAC,UAAU,CAAC,YAAY,KAAK,SAAS;oBACvC,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE;oBAC3C,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CACxB,QAAuB,EACvB,MAMC;IAED,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,YAAY,GAAG,QAAQ,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC;IAClE,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC;QAChC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;KAC1E,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,KAAsB,EAAE,GAAW;IAClD,OAAO,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,CAAC;AACjE,CAAC;AAED,0EAA0E;AAC1E,SAAS,IAAI,CAAC,KAAsB,EAAE,GAAW;IAC/C,OAAO,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;AACpD,CAAC;AAED,SAAS,UAAU,CAAC,KAAsB,EAAE,GAAW;IACrD,OAAO,CACL,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,GAAG,eAAe,IAAI,GAAG,CAC1E,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,SAA8B;IAC9C,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,YAAY,CAAC,SAAS,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,aAAa,CAAC,KAAsB;IAC3C,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,WAAW;QACxB,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzE,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,SAA8B,EAC9B,cAAsB;IAEtB,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO;IACtC,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;QACjD,OAAO,EACL,6EAA6E;YAC7E,wBAAwB;QAC1B,MAAM,EAAE,aAAa,CAAC,kBAAkB;QACxC,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,MAA8C;IACjE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACpC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAC1B,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC;QACb,CAAC,CAAE,MAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACpD,CAAC"}

package/dist/esm/testing/index.d.ts

@@ -7,4 +7,5 @@
  */
 export { appPrincipal, bearerRequest, connectionContext, expiredJwt, fakeVerifier, fakeZoneClient, sessionAuthContext, unsignedJwt, userPrincipal, validJwt, } from "./testUtils.js";
 export type { FakeZoneClient, FakeZoneClientOptions, ZoneCalls } from "./testUtils.js";
+export { resetInteractiveDefinitions } from "../interactive.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/esm/testing/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/testing/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,UAAU,EACV,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,QAAQ,GACT,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,cAAc,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/testing/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,UAAU,EACV,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,QAAQ,GACT,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,cAAc,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACvF,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/esm/testing/index.js

@@ -6,4 +6,5 @@
  * `@keycardai/eve/testing`.
  */
 export { appPrincipal, bearerRequest, connectionContext, expiredJwt, fakeVerifier, fakeZoneClient, sessionAuthContext, unsignedJwt, userPrincipal, validJwt, } from "./testUtils.js";
+export { resetInteractiveDefinitions } from "../interactive.js";
 //# sourceMappingURL=index.js.map

package/dist/esm/testing/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/testing/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,UAAU,EACV,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,QAAQ,GACT,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/testing/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,UAAU,EACV,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,QAAQ,GACT,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@keycardai/eve",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "[Preview] Keycard auth adapters for eve agents: a zone token verifier for the channel auth walk, Keycard-backed connection auth, and interactive authorization over the zone's web flow",
   "license": "MIT",
   "repository": {
@@ -30,15 +30,15 @@
     }
   },
   "dependencies": {
-    "@keycardai/oauth": "0.24.1"
+    "@keycardai/oauth": "0.25.0"
   },
   "peerDependencies": {
-    "eve": ">=0.54.3 <0.55.0"
+    "eve": ">=0.71.3 <0.72.0"
   },
   "devDependencies": {
     "@jest/globals": "^30.0.4",
     "@types/node": "^25.6.0",
-    "eve": "0.54.3",
+    "eve": "0.71.3",
     "jest": "^30.0.4",
     "ts-jest": "^29.4.7",
     "typescript": "^5.8.3"